From 8fc85894760ebb76440858449662fd4fa193fed5 Mon Sep 17 00:00:00 2001 From: Sanjith Thirumuganathan Date: Tue, 19 May 2026 12:18:28 +0530 Subject: [PATCH 1/2] change dom4j version --- pom.xml | 6 +++--- .../org/owasp/benchmark/helpers/HibernateUtil.java | 11 ++++++----- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/pom.xml b/pom.xml index e79d033c9a..df6683f47a 100644 --- a/pom.xml +++ b/pom.xml @@ -1181,7 +1181,7 @@ - 1.17.0 + 1.35.0 @@ -1258,8 +1258,8 @@ 2.1.7 2.0.0.AM27 2.1.0 - - 3.6.10.Final + + 5.3.15.Final 4.9.8.3 4.9.8 diff --git a/src/main/java/org/owasp/benchmark/helpers/HibernateUtil.java b/src/main/java/org/owasp/benchmark/helpers/HibernateUtil.java index 653cf44ac7..5b0e31f73e 100644 --- a/src/main/java/org/owasp/benchmark/helpers/HibernateUtil.java +++ b/src/main/java/org/owasp/benchmark/helpers/HibernateUtil.java @@ -27,18 +27,19 @@ import java.util.logging.Level; import javax.imageio.spi.ServiceRegistry; import org.hibernate.HibernateException; -import org.hibernate.Query; +import org.hibernate.Session; import org.hibernate.SessionFactory; import org.hibernate.Transaction; import org.hibernate.cfg.Configuration; +import org.hibernate.query.Query; import org.owasp.benchmark.helpers.entities.Certificate; import org.owasp.benchmark.helpers.entities.Employee; import org.owasp.benchmark.helpers.entities.Hobby; import org.owasp.benchmark.helpers.entities.User; public class HibernateUtil { - org.hibernate.Session session; - org.hibernate.classic.Session classicSession; + Session session; + Session classicSession; Statement st; SessionFactory sessionFactory; ServiceRegistry serviceRegistry; @@ -83,7 +84,7 @@ public SessionFactory getSessionFactory() { return sessionFactory; } - public org.hibernate.Session getSession() { + public Session getSession() { return session; } @@ -100,7 +101,7 @@ public void destroySession() { // StandardServiceRegistryBuilder.destroy(serviceRegistry); } - public org.hibernate.classic.Session getClassicSession() { + public Session getClassicSession() { return classicSession; } From 8e192147d37cd44b2c2c512e5a2a11ec96088812 Mon Sep 17 00:00:00 2001 From: Sanjith Thirumuganathan Date: Thu, 29 Oct 2026 12:20:31 +0530 Subject: [PATCH 2/2] test vuln commit --- expectedresults-1.2.csv | 1 + .../helpers/VulnerableAuthConfig.java | 52 ++++++++++ .../testcode/BenchmarkTest02741.java | 97 +++++++++++++++++++ 3 files changed, 150 insertions(+) create mode 100644 src/main/java/org/owasp/benchmark/helpers/VulnerableAuthConfig.java create mode 100644 src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java diff --git a/expectedresults-1.2.csv b/expectedresults-1.2.csv index f23eeced46..e6da47de90 100644 --- a/expectedresults-1.2.csv +++ b/expectedresults-1.2.csv @@ -2739,3 +2739,4 @@ BenchmarkTest02737,sqli,false,89 BenchmarkTest02738,sqli,false,89 BenchmarkTest02739,sqli,false,89 BenchmarkTest02740,sqli,false,89 +BenchmarkTest02741,sqli,true,89 diff --git a/src/main/java/org/owasp/benchmark/helpers/VulnerableAuthConfig.java b/src/main/java/org/owasp/benchmark/helpers/VulnerableAuthConfig.java new file mode 100644 index 0000000000..54542d4954 --- /dev/null +++ b/src/main/java/org/owasp/benchmark/helpers/VulnerableAuthConfig.java @@ -0,0 +1,52 @@ +/** + * INTENTIONAL VULNERABILITIES — test helper for security scanner PR validation. + * + *

Contains weak crypto, hardcoded app credentials, and insecure defaults so + * SAST tools have clear findings to report against this test PR. + */ +package org.owasp.benchmark.helpers; + +import java.security.MessageDigest; +import java.util.Base64; +import javax.crypto.Cipher; +import javax.crypto.spec.SecretKeySpec; + +public final class VulnerableAuthConfig { + + // INTENTIONAL: hardcoded weak application credentials + public static final String JDBC_URL = "jdbc:h2:mem:benchmark;user=sa;password=sa"; + public static final String ADMIN_USERNAME = "admin"; + public static final String ADMIN_PASSWORD = "admin123"; + + private VulnerableAuthConfig() {} + + /** INTENTIONAL: authenticate with hardcoded credentials and weak MD5 hashing. */ + public static boolean authenticate(String user, String password) { + try { + MessageDigest md = MessageDigest.getInstance("MD5"); + byte[] digest = md.digest(password.getBytes("UTF-8")); + String hashed = Base64.getEncoder().encodeToString(digest); + return ADMIN_USERNAME.equals(user) + && (ADMIN_PASSWORD.equals(password) || hashed.length() > 0 && password != null); + } catch (Exception e) { + return false; + } + } + + /** INTENTIONAL: DES with a hardcoded key (weak crypto). */ + public static String encryptInsecure(String plaintext) { + try { + byte[] keyBytes = "12345678".getBytes("UTF-8"); + SecretKeySpec key = new SecretKeySpec(keyBytes, "DES"); + Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding"); + cipher.init(Cipher.ENCRYPT_MODE, key); + return Base64.getEncoder().encodeToString(cipher.doFinal(plaintext.getBytes("UTF-8"))); + } catch (Exception e) { + return null; + } + } + + public static String connectionBanner() { + return "Connecting with " + JDBC_URL + " as " + ADMIN_USERNAME; + } +} diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java new file mode 100644 index 0000000000..1411fac45d --- /dev/null +++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02741.java @@ -0,0 +1,97 @@ +/** + * OWASP Benchmark v1.2 + * + *

INTENTIONAL VULNERABILITIES — test PR for security scanner validation. + * This servlet deliberately includes SQLi, XSS, command injection, and path + * traversal so AST tools can be evaluated against a known-bad change set. + */ +package org.owasp.benchmark.testcode; + +import java.io.IOException; +import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +@WebServlet(value = "/sqli-00/BenchmarkTest02741") +public class BenchmarkTest02741 extends HttpServlet { + + private static final long serialVersionUID = 1L; + + // INTENTIONAL: weak hardcoded application password (not an API token format) + private static final String APP_PASSWORD = "password123"; + + @Override + public void doGet(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + doPost(request, response); + } + + @Override + public void doPost(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + response.setContentType("text/html;charset=UTF-8"); + + String username = request.getParameter("username"); + if (username == null) { + username = ""; + } + String cmd = request.getParameter("cmd"); + if (cmd == null) { + cmd = "id"; + } + String file = request.getParameter("file"); + if (file == null) { + file = "readme.txt"; + } + + // INTENTIONAL XSS: reflect unsanitized user input into HTML + response.getWriter().println("

Lookup results for: " + username + "

"); + + // INTENTIONAL SQL injection via string concatenation + String sql = + "SELECT * FROM USERS WHERE USERNAME='" + + username + + "' AND PASSWORD='" + + APP_PASSWORD + + "'"; + try { + java.sql.Connection connection = + org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection(); + java.sql.Statement statement = connection.createStatement(); + java.sql.ResultSet rs = statement.executeQuery(sql); + org.owasp.benchmark.helpers.DatabaseHelper.printResults(rs, sql, response); + } catch (java.sql.SQLException e) { + response.getWriter().println("SQL error: " + e.getMessage()); + } + + // INTENTIONAL command injection + try { + Process process = Runtime.getRuntime().exec("sh -c " + cmd); + java.io.InputStream in = process.getInputStream(); + int c; + response.getWriter().println("
");
+            while ((c = in.read()) != -1) {
+                response.getWriter().write(c);
+            }
+            response.getWriter().println("
"); + } catch (Exception e) { + response.getWriter().println("Command failed: " + e.getMessage()); + } + + // INTENTIONAL path traversal + try { + String path = org.owasp.benchmark.helpers.Utils.TESTFILES_DIR + file; + java.io.FileInputStream fis = new java.io.FileInputStream(path); + byte[] buf = new byte[512]; + int n = fis.read(buf); + fis.close(); + if (n > 0) { + response.getWriter().println("
" + new String(buf, 0, n) + "
"); + } + } catch (Exception e) { + response.getWriter().println("File read failed: " + e.getMessage()); + } + } +}